clawdbot vulnerabilities (npm)
11 vulnerabilities.
-
clawdbotnpm OpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization 6.9 Medium -
clawdbotnpm OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity 8.2 High -
clawdbotnpm OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints 7.1 High -
clawdbotnpm OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering 8.7 High -
clawdbotnpm OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive 6.7 Medium -
clawdbotnpm OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding 6.8 Medium -
clawdbotnpm OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities 6.5 Medium -
clawdbotnpm OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch 2.1 Low -
clawdbotnpm OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand 7.8 High -
clawdbotnpm Authenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variable 8.8 High -
clawdbotnpm OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl 8.8 High